astro/public-env-secret

Why

Astro exposes only PUBLIC_ variables to client-side code, and it does so by writing their values into the bundle. A name such as PUBLIC_STRIPE_SECRET_KEY publishes the key to every visitor, in every island and script that reads it, and in every cached copy of that bundle.

Fix

Rename it without the prefix and read it only in server code (front matter of an on-demand page, an endpoint, an action). Better, declare it in the env.schema of astro.config as envField.string({ context: 'server', access: 'secret' }) and import it from astro:env/server; Astro then refuses to put it in a client bundle. Rotate a key that was ever deployed under a public name.

Examples

---
// bad
const stripe = new Stripe(import.meta.env.PUBLIC_STRIPE_SECRET_KEY)
// good
import { STRIPE_SECRET_KEY } from 'astro:env/server'
const stripe = new Stripe(STRIPE_SECRET_KEY)
---

Sources

• Astro docs, Using environment variables (PUBLIC_ prefix and astro:env)

Read it in the terminal

npx github:dawidolko/frontend-skills explain astro/public-env-secret